PT-2025-32383 · Openbao+1 · Openbao+1

Cipherboy · Published 2025-08-08 · Updated 2025-09-12 · CVE-2025-55001

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below

Description OpenBao allows the assignment of policies and MFA attribution based on entity aliases. When the username as alias=true parameter in the LDAP auth method is used, the supplied username is used without normalization, potentially allowing an attacker to bypass alias-specific MFA requirements.

Recommendations OpenBao versions prior to 2.3.2: Remove all usage of the username as alias=true parameter and update any entity aliases accordingly.

Exploit

Fix

Weakness Enumeration

CWE-156

Related Identifiers

BDU:2025-11279

CVE-2025-55001

GHSA-2Q8Q-8FGW-9P6P

GO-2025-3859

OPENSUSE-SU-2025:15434-1

SUSE-SU-2025:02912-1

Affected Products

Openbao

Red Os

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55001.json · Exploit
• https://github.com/openbao/openbao/commit/c52795c1ef746c7f2c510f9225aa8ccbbd44f9fc · Patch
• https://github.com/openbao/openbao/security/advisories/GHSA-2q8q-8fgw-9p6p · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02912-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11279 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15434-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6013 · Security Note
• https://osv.dev/vulnerability/GHSA-2q8q-8fgw-9p6p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55001 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55001 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3859 · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://suse.com/security/cve/CVE-2025-54801 · Note
• https://suse.com/security/cve/CVE-2025-50738 · Note
• https://t.me/cveNotify/131546 · Telegram Post